The Genetic Data That Fell Through the Policy

On 27 May 2026, the California Attorney General filed suit in San Francisco Superior Court against Chrome Holding Co. and ChromeCo, Inc. — the entities formerly known as 23andMe Holding Co. and 23andMe, Inc. The claims run under the Genetic Information Privacy Act, the Reasonable Data Security Law, the California Consumer Privacy Act, and California's unfair competition and false advertising statutes.

Status update. On 10 July 2026, a US bankruptcy judge held that 23andMe's confirmed Chapter 11 plan bars California from pursuing monetary relief against the successor entities, and ordered the state to drop its damages claims or dismiss. California may still seek non-monetary remedies such as injunctions. The ruling is jurisdictional — it does not test the merits of the governance allegations discussed below, which remain the analytically useful part of the complaint.

Most coverage has treated this as a breach story. It is more useful read as a governance story, because the complaint documents failures in seven distinct domains, and they are not independent of one another.

Seven Failures, One Root

Laid out as a map, the allegations look like this. The left column is what went wrong. The right column is the discipline that owns it.

What the complaint alleges	Governance domain
Genetic data not placed in the tier its protection required	Data classification
No MFA for customers; no password blocklisting	Access control
A 5× login spike ignored; no effective alerting	Detection & monitoring
A four-day investigation that examined nothing	Incident response
A relatedness feature that indexed the whole opted-in base	Secure design
Attack credentials inherited from a former partner's breach	Third-party risk
Individual consent for data describing whole families	Consent architecture
A ransom paid, a cover story bought, the public misled	Disclosure & ethics

Eight rows, seven domains — access control and monitoring are close cousins. The temptation is to read this as a list of things to fix. That reading misses the structure. One of these failures sits upstream of most of the others, and fixing it would have changed their likelihood.

The Node Upstream: The Category the Policy Skipped

According to the complaint, 23andMe maintained the documents you would expect. An Information Security Policy. A Network Security Policy. A Data Classification Policy operating a three-tier system.

The Information Security Policy discussed protecting business information generally and said nothing specific to genetic data. The Network Security Policy was a standard network security policy, addressing nothing particular to genetic or ancestry information. And the Data Classification Policy — the document whose entire function is to tell staff how sensitive a given category of data is — did not state which of its three tiers genetic data fell into. None of the three classifications specified whether they included genetic or ancestry information at all.

"A genetic testing company ran a data classification policy that never said where genetic data belonged."

This is the upstream node because classification is where an organization records how much the rest of its controls should care. A tier assignment is not paperwork; it is the input that sets the access requirement, the monitoring sensitivity, the retention period, the breach threshold, and the depth of design review a new feature receives. Get the tier wrong — or never set it — and every downstream control inherits the error.

The complaint shows exactly that inheritance. If genetic data had been placed in the most sensitive tier, that tier required multi-factor authentication — and 23andMe did not require MFA for customer accounts until November 2023, after the breach. The access-control failure was not separate from the classification failure. It was the classification failure, expressed one layer down.

How the Omission Propagated

Trace the same logic through the rest of the map and the pattern holds. Each downstream failure is more explicable once you know the data was never placed in the tier that would have driven the controls.

Access control and monitoring

Top-tier data warrants MFA, credential blocklisting, and tuned alerting. None was in place. A 6 July 2023 login spike — over five times normal, a single actor making 1,300 requests per minute from one IP — passed without action. Monitoring sensitivity is calibrated to data value; data that was never valued was never watched closely.

Secure design

The DNA Relatives feature was built so an opted-in customer could see only genuine matches. A coding error let a doctored query return any opted-in customer's data, related or not, turning laborious clicking into a searchable index. A feature built entirely on genetic relatedness, handling the organization's most sensitive category, is exactly the feature a classification-driven design review exists to scrutinize. There was no classification to drive one.

Third-party risk

The attack used credential stuffing, with credentials drawn largely from the 2017 breach of MyHeritage — a former 23andMe partner. Credentials leaking from a partner's incident into your own authentication is a supply-chain exposure, and it is one that top-tier classification would have flagged as a scenario worth defending against.

Incident response and disclosure

In August 2023, the company opened an investigation into a Reddit post advertising stolen data, relied on two sample records that happened to belong to people who had made their profiles public, and closed it after four days without examining what was for sale. Then, while telling the public it had no indication of an incident within its systems, it was negotiating with the threat actor — ultimately paying $400,000 in cryptocurrency in exchange for reporting the exploited vulnerabilities, reporting two more, destroying the stolen data, deleting damaging posts, and providing a cover story that mitigated the severity of the breach. The complaint notes it is unknown whether any data was in fact deleted.

Response urgency, too, tracks perceived data value. An organization that had classified this data at the top tier would have escalated the July spike, resourced the August investigation, and struggled to reconcile a public denial with what it was privately paying to suppress.

The One Failure Classification Would Not Have Fixed

There is a limit to how far the root-cause story reaches, and it is important to name it. One failure on the map is not downstream of classification, because it is not a control failure at all. It is structural.

The mechanics: a threat actor accessed roughly 14,000 accounts directly. The DNA Relatives coding error then exposed far more.

Of the 6.9 million affected, roughly 5.5 million were reached through DNA Relatives and a further 1.4 million through Family Tree. The great majority had secure accounts, sound passwords, and no involvement in the credential stuffing whatsoever. Their exposure came through their relatives.

Every person who opted into relative matching was, in practical effect, making a disclosure decision on behalf of people who never saw the interface.

This is the consent-architecture failure, and no amount of classification fixes it. Consent frameworks assume a data subject who can be identified, informed, and asked. Genetic data describes people who cannot be — relatives who never used the service, relatives who declined to, relatives not yet born. Better classification would have forced the organization to confront this when designing a relatedness feature. It would not have solved it, because the problem is not that the data was mishandled. The problem is that genetic data does not fit a consent model built around the individual.

So the map has two kinds of failure on it. Six that flow from a missing classification, and one that classification would only have surfaced — a structural limit that every holder of familial data shares, whether their governance is excellent or absent.

Reading the Map as a Control Set

The applicability question comes first, and it catches more organizations than expect it. GIPA reaches entities that sell, market, interpret or offer direct-to-consumer genetic testing, that analyze genetic data outside a clinical diagnostic relationship, or that collect, use, maintain or disclose genetic data derived from such testing. And because 23andMe was not a HIPAA-covered entity, no federal health regulator had jurisdiction; state attorneys general and state genetic-privacy statutes did the entire job. Any organization holding health-adjacent data outside the clinical perimeter should assume the same pattern.

From the map, five controls follow — the first upstream, the rest flowing from it, and the last standing apart.

• Classify the sensitive category explicitly, by name. A tier structure that does not say where your defining data sits has not classified it. This is the upstream control; the next three inherit their calibration from it.
• Verify the implied controls actually exist in production. If the tier assignment requires MFA, monitoring, or design review, confirm each is deployed. The gap between a policy that implies a control and a system that runs it is where this case was lost.
• Extend classification into secure design and vendor review. New features touching the top tier get a design review; credential and data flows from partners get assessed against it. Classification is only upstream if something downstream actually consumes it.
• Pre-align incident response and public communications. Decide in advance who owns the factual record and how technical findings reach external statements. Two functions describing one incident differently is what converts a security claim into a deception claim.
• Test whether consent covers everyone the processing affects. Where it structurally cannot — relational data, familial data, beneficiary data — record that as a finding and mitigate through design limits. This one does not flow from classification; it is the standing limit classification only reveals.

The Underlying Point

The complaint records testimony from the company's former chief executive, given during the bankruptcy proceedings, that she considered her email and bank accounts potentially more sensitive than her genetic information.

Most people, asked casually, would probably agree with her — and on the axis she is using, they would be right. For immediate, actionable harm, a compromised bank login or email account is far more dangerous than a leaked genome. Someone can drain the account today; nobody does anything with your DNA this afternoon. If sensitivity means "how quickly can this hurt me," genetic data ranks low.

It helps to be concrete about what a saliva sample actually contains, because the everyday intuition badly underestimates it. A genome is not a fact about one health condition; it is a lifelong, unchangeable record that can reveal disease predisposition, carrier status, ancestry, and family relationships — including parentage that was never disclosed. The harms are not hypothetical. In the United States, federal law bars genetic discrimination in health insurance and employment but pointedly does not cover life, disability, or long-term-care insurance, where genetic risk can lawfully be used against an applicant. Because relatives share DNA, a single leaked genome exposes family members who never tested — the same mechanism that let investigators identify the Golden State Killer through a distant relative's consumer upload. And the breach reporting alleged the attacker singled out users with Ashkenazi Jewish and Chinese ancestry, which is ethnic targeting in its most literal form.

There is a reason law enforcement must clear legal process before compelling someone's DNA. A saliva sample is among the most revealing things a person can hand over, and the law treats it that way in the criminal context even where commercial classification does not.

The problem is that a data classification cannot be built on that axis, because genetic data has three properties a bank account does not. A bank account can be remediated — frozen, reissued, reset — and the exposure ends; a genome has no reset, so the harm need not be fast to be permanent. A bank account is yours alone; a genome exposes your relatives, including those who never consented and those not yet born. And a leaked password is worth most on day one and decays, while a genome's inferential value appreciates as science advances toward uses that do not exist yet.

So the testimony is not the error of one executive. It is the ordinary human instinct about sensitivity, applied to the one data class where that instinct fails — which is precisely how a company ends up never placing its most consequential asset in the tier its protection required. An organization's data classification is a written record of what its leadership believes about the data it holds. Where that belief follows the everyday intuition, every control calibrated to it is wrong by the same margin — and the error will not surface in a policy review, because the policy will look complete.

It is worth being concrete about what the omission cost, because the consequences did not arrive as a single penalty. They arrived as several liabilities at once: a consumer class settlement of $46.75 million approved in July 2026; a separate $18 million settlement with a coalition of 42 state attorneys general; a £2.31 million fine from the UK Information Commissioner's Office; the California enforcement action; and, ultimately, a Chapter 11 bankruptcy in which a company once valued in the billions was sold for $305 million.

The security failings in this case were ordinary: no multi-factor authentication, no password blocklisting, no query validation, no alerting on a fivefold login spike. What made them consequential was the nature of the data they were protecting — which the organization had never written down, and so never defended accordingly.

This article is provided for general information only and does not constitute legal advice. It describes allegations in People of the State of California v. Chrome Holding Co. et al., No. CGC-26-636891 (Cal. Super. Ct., San Francisco, filed 27 May 2026). Those allegations have not been proven and nothing here should be read as a finding of liability. On 10 July 2026 a US bankruptcy court barred California from seeking monetary relief against the successor entities, leaving non-monetary remedies available; the case status may have developed further since publication. Organizations should obtain advice specific to their circumstances and jurisdictions.